ITIL Foundations
by James Pengelly (ed)
Stephen Bajada. (c) 2004. Copying Prohibited.
Reprinted for Elzbieta Pluta, Symantec
[e-mail]
Reprinted with permission as a subscription benefit of Books24x7,
http://www.books24x7.com/
All rights reserved. Reproduction and/or distribution in whole or in part in
electronic,paper or other forms without written permission is prohibited.
i
Table of Contents
Incident Management.......................................................................................................................1
Terms and Definitions............................................................................................................1
Incident Management Activities:............................................................................................1
Detecting and recording...................................................................................................1
Classification and initial support
.......................................................................................1
Investigation and diagnosis..............................................................................................2
Resolution and Recovery.................................................................................................3
Incident closure................................................................................................................3
1st, 2nd and 3rd line support
............................................................................................3
Relationship between Incident, Problem and Change Management Processes...................3
Benefits..................................................................................................................................4
Reduced business impact of incidents.............................................................................4
Proactive Identification of beneficial system enhancements and amendments...............4
Availability of business-focused management information related to the SLA................4
Improved monitoring of SLA.............................................................................................4
Improved management information.................................................................................4
Better staff utilization and efficiency.................................................................................4
More accurate CMDB information....................................................................................4
Improved user and customer satisfaction........................................................................4
Exercises Incident Management (Process)
......................................................................5
Incident Management
The Service Desk (function) owns the incident management (process). The goal for incident
management is to restore service as soon as possible, minimizing the disruption to the business.
Terms and Definitions
An incident is defined as any event that is not part of the expected operation of a service that
causes (or may cause) an interruption to (or a reduction in) the quality of that service. This is true of
all incidents involving hardware, applications, service requests or documentation. Most incidents are
related to either hardware or software.
Documentation is an integral part of the IT department. If documented procedures for an operating
system are changed and the supporting staff is not informed, the procedure will likely fail due to the
use of an incorrect or out of date procedure - that would be considered an incident. Applications,
hardware and service requests are within the scope of incident management support.
Incident Management Activities:
Detecting and recording
All communications with the service desk function regarding an incident or request should be
recorded regardless of whether the service desk detected the incident or if a user reported it. The
capturing of incidents is beneficial for a number of other processes. Problem management can use
the information from all tickets to do trend analysis. Service level management can use the
information for metrics in service management. Change management can use the information to
detect if incidents occurred due to the lack of proper change management.
Classification and initial support
The service desk, through the incident management process, will classify each incident or service
request coming into the service desk. It will be determined early whether it is an incident or service
request.
Reprinted for [e-mail], Symantec GTSLearning, Stephen Bajada (c) 2004, Copying Prohibited
ITIL Foundations 2
If it is an incident, it will then be determined if the incident is routine (such as printer start), known
error (lack of space on server) or a known problem (blue screen of death for instance). Each
possibility will have handling processes around them.
Part of classification is to determine the priority of the incident. This is done through an evaluation of
impact, urgency and expected effort. Once the classification is determined, a priority is assigned.
" Impact - The degree to which the business is affected by the incident
" Urgency - The speed in which the incident needs to be resolved
" Expected effort - The resources needed to rectify the incident
Part of initial support is to inform problem management of any new or unmatched incidents as
quickly as possible.
The service desk will either resolve or quickly find a resolution using the incident management
processes.
Investigation and diagnosis
Understanding the details of the incident by collecting any pertinent information related to the
incident or if available consulting a knowledge base is an important part of the investigation and
diagnosis stage. This information will determine any resolution activity, workarounds or escalation
process.
There are 2 forms of recognized escalation:
Reprinted for [e-mail], Symantec GTSLearning, Stephen Bajada (c) 2004, Copying Prohibited
ITIL Foundations 3
" Functional - usually from 1st line upward due to lack of skill set to resolve the incident
" Hierarchical - usually a manual escalation through authority and can be done at any time
When the right resolving group has accepted the incident and evaluated the type of work that is
needed, both the service desk and the customer must be informed of the time to resolution.
Resolution and Recovery
Incident management will use a workaround solution to resolve an incident or initiate a request for
change (RFC).
Incident closure
The incident can only be closed with the user's permission. Confirmation of incident resolution will
be made with the user and details of the resolution must be placed in the Incident Control System.
1st, 2nd and 3rd line support
Within the incident management process there are multiple lines of support. The service desk is
usually considered 1st line support. 2nd, 3rd line and up escalation is based on what skill set is
needed, determined by the service desk.
The service desk (1st line) accepts an incident. If after recording and some initial support it is
determined that the resolution of the incident is not one that is presently known or the skill set is not
available at 1st line, the service desk will escalate based on functional escalation (skill set) to 2nd
line. If 2nd line can't resolve the incident, they will escalate to 3rd line and so on. Regardless of
which line of support resolves the incident, it is the responsibility of the service desk (1st line) to
confirm closure with the customer.
Relationship between Incident, Problem and Change
Management Processes
The relationship between processes highlights the importance of ITIL within the IT environment. The
Incident Management (process) through the Service Desk (function) collects information in the
incident control system. Incident Management can resolve about 85% at 1st line. Anything the
Reprinted for [e-mail], Symantec GTSLearning, Stephen Bajada (c) 2004, Copying Prohibited
ITIL Foundations 4
Incident Management process cannot resolve has to be escalated to Problem Management.
Problem Management relies on Incident Management to provide enough information to create a
work-around. The work-around is for incident management to provide an interim solution to satisfy
the user. To permanently remove the incident it has to be determined what the known error is. After
the known error is determined and the CI (configuration item) at fault is identified, a request for
change (RFC) is presented to the change management process for handling.
Benefits
Reduced business impact of incidents
By having proper incident management processes in place the duration of the incident will be
reduced, resulting in the management of the customer's expectations to resolution.
Proactive Identification of beneficial system enhancements and
amendments
The ability to use the Incident Control System to analyze incidents, what is causing them and how
they can be resolved (Knowledge base).
Availability of business-focused management information related to the
SLA
The incident control system being used by the service desk contains information on all incidents.
There will be metrics indicating when the incident was logged, resolved and closed. This information
will be compared with the SLA requirements, which will indicate if the incidents were resolved within
SLA targets.
Improved monitoring of SLA
The service desk using the incident management process will monitor all Incident Control Tickets
being escalated to 2nd level support and up to ensure that SLA targets are met.
Improved management information
Incident management will capture all information related to incidents, both the symptoms and the
resolution. This will give management a better insight into the IT infrastructure. Information on how
many incidents for each classification are created, including what areas were affected and how long
it took for resolution.
Better staff utilization and efficiency
Incident management is responsible for ensuring that the right resources are working on the right
problems. By doing this, the resolving groups will be used more efficiently and at the correct times.
More accurate CMDB information
Incident management will ensure that all information going into the Incident Control System ticket is
correct. The information that populates the ticket comes from the CMDB. Verification of the
information will always be done and any discrepancies will be corrected.
Improved user and customer satisfaction
The faster incidents are resolved correctly the first time the more satisfied the user/customer. The
Incident management process ensures that speed and accuracy is incorporated into the process of
incident resolution.
Reprinted for [e-mail], Symantec GTSLearning, Stephen Bajada (c) 2004, Copying Prohibited
ITIL Foundations 5
Exercises Incident Management (Process)
The ABC Cookie Company has set up the Incident Management process. A call came into the
Service Desk regarding an issue with one of the ovens. What activities would incident management
do to try and resolve the incident?
1. Who will close the ticket with the baker, incident management or the Service
Desk?_______________
2. If incident management could not resolve the oven issue at 1st level what kind of
escalation would be used to get the right skills working on it: Hierarchical or Functional?
_______________
3. Which of the following is not a benefit of Incident Management? ______
A. Better staff utilization and efficiency
B. Elimination of lost Incidents
C. More accurate CMDB information
D. Improved user and customer satisfaction
E. Reduced risk of unauthorized software
Answers
1. The Service Desk is the function and it owns the Incident Management Process so the
Service Desk will close the ticket with the baker
2. Functional escalation to 2nd or 3rd level support
3. a) Better staff utilization and efficiency is not a benefit of Incident Management
Reprinted for [e-mail], Symantec GTSLearning, Stephen Bajada (c) 2004, Copying Prohibited